From bb14073a6cc227575e3d14473653808c2860b4ab Mon Sep 17 00:00:00 2001
From: "google-labs-jules[bot]"
 <161369871+google-labs-jules[bot]@users.noreply.github.com>
Date: Sun, 29 Mar 2026 03:55:42 +0000
Subject: [PATCH] =?UTF-8?q?=F0=9F=9B=A1=EF=B8=8F=20Sentinel:=20[CRITICAL]?=
 =?UTF-8?q?=20Fix=20authorization=20bypass=20in=20file=20deletion=20endpoi?=
 =?UTF-8?q?nt?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Co-authored-by: xb1g <70068561+xb1g@users.noreply.github.com>
---
 app/api/upload/route.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/app/api/upload/route.ts b/app/api/upload/route.ts
index 56d019c7..518d6e91 100644
--- a/app/api/upload/route.ts
+++ b/app/api/upload/route.ts
@@ -75,7 +75,7 @@ export async function DELETE(request: NextRequest) {
       return NextResponse.json({ error: "Valid fileName is required" }, { status: 400 });
     }
 
-    if (!fileName.includes(`submissions/${user.id}/`)) {
+    if (!fileName.startsWith(`submissions/${user.id}/`)) {
       return NextResponse.json({ error: "Access denied" }, { status: 403 });
     }